{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/bleach/issues/130","repository_url":"https://api.github.com/repos/mozilla/bleach","labels_url":"https://api.github.com/repos/mozilla/bleach/issues/130/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/bleach/issues/130/comments","events_url":"https://api.github.com/repos/mozilla/bleach/issues/130/events","html_url":"https://github.com/mozilla/bleach/issues/130","id":39844802,"number":130,"title":"bleach linkify unescapes escaped HTML sometimes","user":{"login":"imankulov","id":75075,"avatar_url":"https://avatars.githubusercontent.com/u/75075?v=3","gravatar_id":"","url":"https://api.github.com/users/imankulov","html_url":"https://github.com/imankulov","followers_url":"https://api.github.com/users/imankulov/followers","following_url":"https://api.github.com/users/imankulov/following{/other_user}","gists_url":"https://api.github.com/users/imankulov/gists{/gist_id}","starred_url":"https://api.github.com/users/imankulov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imankulov/subscriptions","organizations_url":"https://api.github.com/users/imankulov/orgs","repos_url":"https://api.github.com/users/imankulov/repos","events_url":"https://api.github.com/users/imankulov/events{/privacy}","received_events_url":"https://api.github.com/users/imankulov/received_events","type":"User","site_admin":false},"labels":[{"id":37904,"url":"https://api.github.com/repos/mozilla/bleach/labels/linkify","name":"linkify","color":"a6ffd4","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/mozilla/bleach/milestones/4","html_url":"https://github.com/mozilla/bleach/milestone/4","labels_url":"https://api.github.com/repos/mozilla/bleach/milestones/4/labels","id":644272,"number":4,"title":"v2.0","description":"","creator":{"login":"jsocol","id":180459,"avatar_url":"https://avatars.githubusercontent.com/u/180459?v=3","gravatar_id":"","url":"https://api.github.com/users/jsocol","html_url":"https://github.com/jsocol","followers_url":"https://api.github.com/users/jsocol/followers","following_url":"https://api.github.com/users/jsocol/following{/other_user}","gists_url":"https://api.github.com/users/jsocol/gists{/gist_id}","starred_url":"https://api.github.com/users/jsocol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsocol/subscriptions","organizations_url":"https://api.github.com/users/jsocol/orgs","repos_url":"https://api.github.com/users/jsocol/repos","events_url":"https://api.github.com/users/jsocol/events{/privacy}","received_events_url":"https://api.github.com/users/jsocol/received_events","type":"User","site_admin":false},"open_issues":12,"closed_issues":5,"state":"open","created_at":"2014-04-29T22:21:29Z","updated_at":"2017-02-24T18:30:33Z","due_on":null,"closed_at":null},"comments":11,"created_at":"2014-08-08T17:24:47Z","updated_at":"2017-02-24T18:30:37Z","closed_at":null,"body":"@jsocol, thanks for your library, we use it for years :+1: \n\nRecently we discovered quite a strange behaviour `linkify` exposes in one scenario. Please, take a look on my example below. As you can see, sometimes it unescapes a correctly escaped tag:\n\n``` python\n\nIn [1]: import bleach\n\nIn [2]: bleach.__version__\nOut[2]: u'1.4'\n\nIn [3]: bleach.linkify('&lt;br&gt;')  # everything is okay\nOut[3]: u'&lt;br&gt;'\n\nIn [4]: bleach.linkify('&lt;br&gt; http://example.com')  # why <br> is unescaped?\nOut[4]: u'<br> <a href=\"http://example.com\" rel=\"nofollow\">http://example.com</a>'\n\nIn [5]: bleach.linkify('&lt;br&gt; <br> http://example.com')  # ... and here it's not again ;-)\nOut[5]: u'&lt;br&gt; <br> <a href=\"http://example.com\" rel=\"nofollow\">http://example.com</a>'\n```\n\nFrankly, I have no idea how it should be fixed. Thanks for any input.\n"},"comment":{"url":"https://api.github.com/repos/mozilla/bleach/issues/comments/282367196","html_url":"https://github.com/mozilla/bleach/issues/130#issuecomment-282367196","issue_url":"https://api.github.com/repos/mozilla/bleach/issues/130","id":282367196,"user":{"login":"kousu","id":987487,"avatar_url":"https://avatars.githubusercontent.com/u/987487?v=3","gravatar_id":"","url":"https://api.github.com/users/kousu","html_url":"https://github.com/kousu","followers_url":"https://api.github.com/users/kousu/followers","following_url":"https://api.github.com/users/kousu/following{/other_user}","gists_url":"https://api.github.com/users/kousu/gists{/gist_id}","starred_url":"https://api.github.com/users/kousu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kousu/subscriptions","organizations_url":"https://api.github.com/users/kousu/orgs","repos_url":"https://api.github.com/users/kousu/repos","events_url":"https://api.github.com/users/kousu/events{/privacy}","received_events_url":"https://api.github.com/users/kousu/received_events","type":"User","site_admin":false},"created_at":"2017-02-24T18:30:37Z","updated_at":"2017-02-24T18:30:37Z","body":"Has anyone thought about workarounds in the meantime? I want to use `linkify` and `clean` to get sanitized HTML with my links auto-linked and **marked `rel=\"nofollow\"`**, which we consider part of sanitization, to avoid spammers exploiting us.\r\n\r\n`bleach.linkify(bleach.clean(html))` produces the `rel=\"nofollow\"`s, but hits this bug, which undoes the `clean`ing, meaning that our bleaching is unsafe.\r\nConversely, `bleach.clean(bleach.linkify(html))` is safely bleached, but it bleaches too much: `rel` gets stripped, making our links unsafe in a weaker way. I could work around this by saying\r\n```\r\n>>> bleach.ALLOWED_ATTRIBUTES[u'a'].append(u'rel')\r\n```\r\n\r\nWhich seems to make the two commute:\r\n```\r\n>>> s=\"<p><a href='//evil.com' rel='author'>Cute Hopping Innocent Bunnies</a></p>\"\r\n>>> bleach.clean(bleach.linkify(s))                               \r\nu'&lt;p&gt;<a href=\"//evil.com\" rel=\"author nofollow\">Cute Hopping Innocent Bunnies</a>&lt;/p&gt;'\r\n>>> bleach.linkify(bleach.clean(s))\r\nu'&lt;p&gt;<a href=\"//evil.com\" rel=\"author nofollow\">Cute Hopping Innocent Bunnies</a>&lt;/p&gt;'\r\n>>> bleach.linkify(bleach.clean(s)) == bleach.clean(bleach.linkify(s))\r\nTrue\r\n```\r\n\r\nbut has this knack for letting a client-chosen `rel` value throgh. There's a [bunch](https://www.w3schools.com/tags/att_a_rel.asp) of values `rel` could take and while I can't think of an attack off the top of my head, that's a scary potential attack surface opening up.\r\n\r\nActually I know at least one (minor) attack: if someone has a blog with comments active and they can post `<a href=\"https://github.com/attacker\" rel=\"me\">AaronPK</a>`, then suddenly that attacker account can convince anyone who uses https://indieauth.com/ that they are the blogger.\r\n\r\nIs the right order clean then link, or link then clean? I think it shouldn't matter, but of course the real world bites us with this `nofollow` thing."}}
{"actor":{"display_login":"kousu"}}